SkyEye模拟Lubbock(PXA25X)非法地址访问

yc200405

用SkyEye模拟Lubbock(PXA25X)开发板，我用ARM Linux 2.4.18内核源代码编译后在里面跑，在start_kernel()的最后部分向内核线程（init)切换的时候居然访问0x00000000（虚拟地址），不过内核是不应该访问低于3G的虚存空间的啊？！
POSIX conformance testing by UNIFIX
OK      ／／我自己打印的调试信息
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
*pgd = 00000000, *pmd = 00000000
Internal error: Oops: 0
CPU: 0
pc : [<00000000>]    lr : [<c00173a8>]    Not tainted
sp : c016ff1c  ip : 60000013  fp : c016ffb8
r10: c016e27c  r9 : c00173b4  r8 : 00000001
r7 : c001763c  r6 : c00205d8  r5 : c016ff64  r4 : c0170c18
r3 : 00000000  r2 : 60000013  r1 : c02dc000  r0 : c016e000
Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  Segment kernel
Control: 3927  Table: C0004000  DAC: 0000001D
Process swapper (pid: 0, stackpage=c016f000)／／显然线程切换还没有实际进行， 但确实在执行__switch_to()
Stack: (0xc016ff0c to 0xc0170000)
ff00:                            c00173a8 00000000 60000093 ffffffff c016e000
ff20: c02dc000 60000013 00000000 c01709ac 00000000 c016e000 c016e000 c02dc000
ff40: c016e000 c016e000 c016ffb8 60000013 c016ff64 c00205d8 c001763c 60000013
ff60: ffffffff 60000013 c01709ac 00000000 c016e000 c016e000 c02dc000 c016e000
ff80: c016e000 c016ffb8 c00205d8 c0170040 c016e000 c0018b64 c0170e34 c017d2ac
ffa0: c0170c40 69052100 c0015260 c016ffd4 c016ffbc c0018498 c00202a0 00004000
ffc0: c01a8874 c017d2b8 c016ffe4 c016ffd8 c0017030 c0018420 c016fffc c016ffe8
ffe0: c000887c c001700c c017d6cc c01a8874 00000000 c0170000 c0008080 c0008788
Backtrace:
Function entered at [<c0020294>] from [<c0018498>]
Function entered at [<c0018414>] from [<c0017030>]
r6 = C017D2B8  r5 = C01A8874  r4 = 00004000
Function entered at [<c0017000>] from [<c000887c>]
Function entered at [<c000877c>] from [<c0008080>]
r4 = C01A8874
Code: bad PC value.
Kernel panic: Attempted to kill the idle task!
In idle task - not syncing

这个时候切换还没有完成，我不明白怎么会访问0地址，是不是中断？

yc200405

不知道SkeEye支不支持XScale的mra        r4, r5, acc0指令,我发现好像是由这条指令引起的未定义指令异常

yc200405

基本上确定是这条指令的问题， 简单的注释掉mra/mar，内核已经到加载根文件系统的地方了